@automattic/vip 4.1.2 → 4.1.4

package/internal/devenv/proxy/proxy_test.go

@@ -8,11 +8,28 @@ import (
 // scriptRunner returns scripted results per docker subcommand for control-flow
 // tests. runErrs is consumed in order for each `run` call (nil = success).
 type scriptRunner struct {
-	running bool    // result for IsRunning's inspect
+	running bool    // proxy container exists and is running
+	stopped bool    // proxy container exists but is stopped (orphan)
 	runErrs []error // sequential results for `run` calls
 	calls   [][]string
 }
 
+// DockerOut scripts `inspect -f {{.State.Running}}`: exit 0 with "true" or
+// "false" when the container exists (running or stopped), error when absent.
+func (s *scriptRunner) DockerOut(ctx context.Context, args ...string) ([]byte, error) {
+	s.calls = append(s.calls, args)
+	if len(args) > 0 && args[0] == "inspect" {
+		switch {
+		case s.running:
+			return []byte("true\n"), nil
+		case s.stopped:
+			return []byte("false\n"), nil
+		}
+		return nil, errDocker
+	}
+	return nil, nil
+}
+
 func (s *scriptRunner) Docker(ctx context.Context, args ...string) error {
 	s.calls = append(s.calls, args)
 	switch {
@@ -23,11 +40,6 @@ func (s *scriptRunner) Docker(ctx context.Context, args ...string) error {
 			return e
 		}
 		return nil
-	case len(args) >= 2 && args[0] == "inspect":
-		if s.running {
-			return nil
-		}
-		return errDocker
 	}
 	return nil
 }
@@ -69,6 +81,49 @@ func TestEnsureNoopWhenAlreadyRunning(t *testing.T) {
 	}
 }
 
+func TestEnsureRemovesStoppedOrphanThenStarts(t *testing.T) {
+	t.Setenv("XDG_DATA_HOME", t.TempDir())
+	// A stopped proxy container exists: inspect succeeds but prints "false".
+	// Ensure must not treat it as running; it removes the orphan (docker rm
+	// without -f) and starts a fresh proxy.
+	r := &scriptRunner{stopped: true}
+	got, err := Ensure(context.Background(), r, EnsureOptions{Domain: "vipdev.lndo.site", free: func(int) bool { return true }})
+	if err != nil {
+		t.Fatalf("Ensure: %v", err)
+	}
+	if got.HTTP != 80 || got.HTTPS != 443 {
+		t.Fatalf("expected default ports, got %+v", got)
+	}
+	var sawRm, sawRun bool
+	for _, c := range r.calls {
+		switch {
+		case len(c) == 2 && c[0] == "rm" && c[1] == ProxyContainerName:
+			if sawRun {
+				t.Fatalf("orphan must be removed before run: %v", r.calls)
+			}
+			sawRm = true
+		case len(c) > 0 && c[0] == "run":
+			sawRun = true
+		}
+	}
+	if !sawRm || !sawRun {
+		t.Fatalf("expected rm then run, got calls: %v", r.calls)
+	}
+}
+
+func TestIsRunningReadsInspectOutput(t *testing.T) {
+	ctx := context.Background()
+	if IsRunning(ctx, &scriptRunner{running: true}) != true {
+		t.Fatal("running container should report true")
+	}
+	if IsRunning(ctx, &scriptRunner{stopped: true}) {
+		t.Fatal("stopped container must not report running")
+	}
+	if IsRunning(ctx, &scriptRunner{}) {
+		t.Fatal("absent container must not report running")
+	}
+}
+
 func TestEnsureRetriesNextPortOnBindFailure(t *testing.T) {
 	t.Setenv("XDG_DATA_HOME", t.TempDir())
 	// First run fails (port busy at bind time despite probe), second succeeds.

package/internal/devenv/proxy/scripts/gen-certs.sh

@@ -5,12 +5,27 @@ set -e
 CA_CERT="${CA_CERT:-/certs/lndo.site.pem}"
 CA_KEY="${CA_KEY:-/certs/lndo.site.key}"
 
+# quiet runs a command with its stderr captured, replaying it only on failure.
+# openssl narrates success on stderr ("Certificate request self-signature ok",
+# "subject=..."), which the CLI would otherwise tee to the user's terminal.
+quiet() {
+  _err=$(mktemp)
+  if "$@" 2>"$_err"; then
+    rm -f "$_err"
+  else
+    _st=$?
+    cat "$_err" >&2
+    rm -f "$_err"
+    return $_st
+  fi
+}
+
 # 1. Ensure the CA exists (idempotent). Subject CN parity: WPVIP Local CA.
 if [ ! -f "$CA_KEY" ]; then
-  openssl genrsa -out "$CA_KEY" 2048
+  quiet openssl genrsa -out "$CA_KEY" 2048
 fi
 if [ ! -f "$CA_CERT" ]; then
-  openssl req -x509 -new -nodes -key "$CA_KEY" -sha256 -days 8675 \
+  quiet openssl req -x509 -new -nodes -key "$CA_KEY" -sha256 -days 8675 \
     -out "$CA_CERT" \
     -subj "/C=US/ST=California/L=San Francisco/O=Automattic/OU=WPVIP/CN=WPVIP Local CA"
 fi
@@ -41,10 +56,10 @@ if [ -n "$CERT_BASENAME" ] && [ -n "$CERT_SANS" ]; then
   done
   set +f
 
-  openssl genrsa -out "$KEY" 2048
-  openssl req -new -key "$KEY" -out "$CSR" \
+  quiet openssl genrsa -out "$KEY" 2048
+  quiet openssl req -new -key "$KEY" -out "$CSR" \
     -subj "/C=US/ST=California/L=San Francisco/O=Automattic/OU=WPVIP/CN=${CN}"
-  openssl x509 -req -in "$CSR" -CA "$CA_CERT" -CAkey "$CA_KEY" \
+  quiet openssl x509 -req -in "$CSR" -CA "$CA_CERT" -CAkey "$CA_KEY" \
     -CAcreateserial -out "$CRT" -days 825 -sha256 -extfile "$EXT"
   rm -f "$CSR" "$EXT"
 

package/internal/devenv/update.go

@@ -3,6 +3,7 @@ package devenv
 import (
 	"context"
 
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/devenv/instancedata"
 )
 
@@ -71,6 +72,7 @@ func applyUpdate(d *instancedata.InstanceData, c UpdateConfig) {
 // Update reads, overlays, re-materializes, and persists an env's instance data.
 // Like Node it does NOT restart — the caller instructs the user to start again.
 func Update(ctx context.Context, slug string, c UpdateConfig) error {
+	debuglog.Printf(ctx, debugNamespace, "Will update an environment %q", slug)
 	d, err := instancedata.Read(slug)
 	if err != nil {
 		return err

package/internal/edgeworkers/build_test.go

@@ -16,7 +16,7 @@ func TestScaffoldDoesNotOverwriteOrInstall(t *testing.T) {
 		t.Fatal(err)
 	}
 	before, _ := os.ReadFile(filepath.Join(dir, "package.json"))
-	if !strings.Contains(string(before), `"0.4.0"`) || !strings.Contains(string(before), `"0.27.0"`) {
+	if !strings.Contains(string(before), `"0.5.0"`) || !strings.Contains(string(before), `"0.27.0"`) {
 		t.Fatalf("dependencies: %s", before)
 	}
 	if err := ScaffoldProject(dir, "assemblyscript"); err == nil {

package/internal/edgeworkers/templates/edge-workers.json

@@ -1,4 +1,4 @@
 {
 	"type": "assemblyscript",
-	"sdk": "@automattic/vip-edge-workers-sdk@0.4.0"
+	"sdk": "@automattic/vip-edge-workers-sdk@0.5.0"
 }

package/internal/edgeworkers/templates/package.json

@@ -8,7 +8,7 @@
 		"build": "vip edge-workers build --all"
 	},
 	"dependencies": {
-		"@automattic/vip-edge-workers-sdk": "0.4.0"
+		"@automattic/vip-edge-workers-sdk": "0.5.0"
 	},
 	"devDependencies": {
 		"assemblyscript": "0.27.0"

package/internal/gql/debug_test.go

@@ -0,0 +1,79 @@
+package gql
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+type debugTransportFunc func(*http.Request) (*http.Response, error)
+
+func (f debugTransportFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+func TestHTTPDiagnosticsPreserveRequestAndOmitSecrets(t *testing.T) {
+	var out bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "@automattic/vip:http", &out)
+	body := `{"operationName":"EdgeWorkers","query":"query EdgeWorkers { me { id } }","variables":{"secret":"body-secret"}}`
+	req, _ := http.NewRequestWithContext(ctx, "POST", "https://user:password-secret@example.test/graphql?token=query-secret", strings.NewReader(body))
+	c := NewClient(Config{Token: "header-secret", HTTPClient: &http.Client{Transport: debugTransportFunc(func(r *http.Request) (*http.Response, error) {
+		got, _ := io.ReadAll(r.Body)
+		if string(got) != body || r.URL.Query().Get("token") != "query-secret" || r.Header.Get("Authorization") != "Bearer header-secret" {
+			t.Fatal("diagnostics changed request")
+		}
+		return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(`{"data":{}}`)), Header: make(http.Header)}, nil
+	})}})
+	resp, err := c.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if !strings.Contains(out.String(), "running fetch https://example.test/graphql") {
+		t.Fatalf("missing fetch diagnostic: %q", out.String())
+	}
+	for _, secret := range []string{"password-secret", "body-secret", "query-secret", "header-secret"} {
+		if strings.Contains(out.String(), secret) {
+			t.Fatalf("diagnostic exposed %s", secret)
+		}
+	}
+}
+
+func TestGraphQLDebugWithHandledErrorsAndRetries(t *testing.T) {
+	var out, ordinaryErrors bytes.Buffer
+	ctx := WithAllowGQLErrors(debuglog.WithLogger(context.Background(), "@automattic/vip:http:graphql", &out))
+	responseBody := `{"errors":[{"message":"message-secret","path":["app"],"extensions":{"code":"FORBIDDEN","token":"extension-secret"}}]}`
+	calls := 0
+	c := NewClient(Config{HTTPClient: &http.Client{Transport: debugTransportFunc(func(r *http.Request) (*http.Response, error) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		calls++
+		status := 200
+		if calls == 1 {
+			status = 503
+		}
+		return &http.Response{StatusCode: status, Body: io.NopCloser(strings.NewReader(responseBody)), Header: make(http.Header)}, nil
+	})}, Middleware: []Middleware{NewErrorMiddleware(ErrorConfig{Stderr: &ordinaryErrors, ExitOnError: true, Exit: func(int) { t.Fatal("handled error exited") }}), NewRetryMiddleware(RetryConfig{MaxAttempts: 2, NoDelay: true})}})
+	req, _ := http.NewRequestWithContext(ctx, "POST", "https://example.test/graphql", strings.NewReader(`{"operationName":"EdgeWorkers","query":"query EdgeWorkers { me { id } }"}`))
+	resp, err := c.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if string(body) != responseBody || calls != 2 || ordinaryErrors.Len() != 0 {
+		t.Fatal("diagnostics changed retry/error handling")
+	}
+	for _, want := range []string{"Retrying", "EdgeWorkers", "Attempt: 1", "GraphQL errors", "FORBIDDEN"} {
+		if !strings.Contains(out.String(), want) {
+			t.Errorf("missing %q in %q", want, out.String())
+		}
+	}
+	for _, secret := range []string{"message-secret", "extension-secret"} {
+		if strings.Contains(out.String(), secret) {
+			t.Fatalf("diagnostic exposed %s", secret)
+		}
+	}
+}

package/internal/gql/error.go

@@ -9,6 +9,8 @@ import (
 	"os"
 
 	json "encoding/json/v2"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // ErrorConfig controls the behavior of the error middleware.
@@ -64,6 +66,11 @@ type errorDoer struct {
 }
 
 func (e *errorDoer) Do(req *http.Request) (*http.Response, error) {
+	operation := ""
+	debugEnabled := debuglog.Enabled(req.Context(), "@automattic/vip:http:graphql")
+	if debugEnabled {
+		operation, _ = operationNameFromBody(req)
+	}
 	resp, err := e.next.Do(req)
 	if err != nil || resp == nil {
 		return resp, err
@@ -84,7 +91,26 @@ func (e *errorDoer) Do(req *http.Request) (*http.Response, error) {
 	resp.Body.Close()
 	resp.Body = io.NopCloser(bytes.NewReader(body))
 
-	if hasGraphQLErrors(body) && !allowGQLErrorsFromContext(req.Context()) {
+	if hasGraphQLErrors(body) {
+		// Node emits safe diagnostic metadata even when the command handles
+		// GraphQL errors itself. Never include messages, variables or extensions
+		// other than the error code in the diagnostic stream.
+		var doc struct {
+			Errors []struct {
+				Path       []any `json:"path"`
+				Extensions struct {
+					Code string `json:"code"`
+				} `json:"extensions"`
+			} `json:"errors"`
+		}
+		if debugEnabled && json.Unmarshal(body, &doc) == nil {
+			for _, item := range doc.Errors {
+				debuglog.Printf(req.Context(), "@automattic/vip:http:graphql", "GraphQL errors in response: operation=%s path=%v code=%s", operation, item.Path, item.Extensions.Code)
+			}
+		}
+		if allowGQLErrorsFromContext(req.Context()) {
+			return resp, nil
+		}
 		for _, m := range extractGraphQLErrorMessages(body) {
 			fmt.Fprintf(e.cfg.Stderr, "Error: %s\n", m)
 		}

package/internal/gql/rechallenge.go

@@ -10,6 +10,7 @@ import (
 
 	json "encoding/json/v2"
 
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/rechallenge"
 )
 
@@ -20,8 +21,8 @@ type RechallengeConfig struct {
 	TokenCache *rechallenge.TokenCache
 	Runner     *rechallenge.Runner
 	// Context, if non-nil, supplies the context used for Parker calls.
-	// Defaults to context.Background(); production should pass the cobra
-	// command's ctx so SIGINT cancels the flow.
+	// Defaults to the request context, preserving command diagnostics and
+	// cancellation through the flow.
 	Context func() context.Context
 	// Interactive, when non-nil, replaces the default
 	// rechallenge.IsInteractiveContext(nil) fallback for the Runner's
@@ -65,13 +66,13 @@ type rechallengeDoer struct {
 	cfg  RechallengeConfig
 }
 
-func (r *rechallengeDoer) ctx() context.Context {
+func (r *rechallengeDoer) ctx(fallback context.Context) context.Context {
 	if r.cfg.Context != nil {
 		if c := r.cfg.Context(); c != nil {
 			return c
 		}
 	}
-	return context.Background()
+	return fallback
 }
 
 func (r *rechallengeDoer) Do(req *http.Request) (*http.Response, error) {
@@ -98,6 +99,8 @@ func (r *rechallengeDoer) Do(req *http.Request) (*http.Response, error) {
 	if r.cfg.TokenCache != nil {
 		if tok, err := r.cfg.TokenCache.Get(scope); err == nil && tok != nil {
 			attachElevatedHeader(req, *tok)
+		} else if err != nil {
+			debuglog.Printf(req.Context(), "@automattic/vip:rechallenge:link", "preflight error: unable to load elevated token")
 		}
 	}
 
@@ -128,13 +131,14 @@ func (r *rechallengeDoer) Do(req *http.Request) (*http.Response, error) {
 	if r.cfg.Wait != nil {
 		wait = r.cfg.Wait()
 	}
-	tok, runErr := r.cfg.Runner.Run(r.ctx(), rechallenge.RunInput{
+	tok, runErr := r.cfg.Runner.Run(r.ctx(req.Context()), rechallenge.RunInput{
 		RequestedOperation: scope,
 		Extension:          *ext,
 		Interactive:        interactive,
 		Wait:               wait,
 	})
 	if runErr != nil || tok == nil {
+		debuglog.Printf(req.Context(), "@automattic/vip:rechallenge:link", "rechallenge flow failed for %s", scope)
 		r.reportStepUpFailure(scope, runErr)
 		// Surface the ORIGINAL error response upstream.
 		return resp, nil

package/internal/gql/retry.go

@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"syscall"
 	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 type RetryConfig struct {
@@ -49,7 +51,12 @@ func (r *retryDoer) Do(req *http.Request) (*http.Response, error) {
 		req.Body = io.NopCloser(bytes.NewReader(body))
 		req.ContentLength = int64(len(body))
 	}
-	retryable := isRetryableOperation(body)
+	operation, parseErr := ParseOperationFromBody(body)
+	retryable := parseErr == nil && operation != nil && !operation.IsMutation
+	operationName := ""
+	if operation != nil {
+		operationName = operation.OperationName
+	}
 	var resp *http.Response
 	var lastErr error
 	for attempt := 1; attempt <= r.cfg.MaxAttempts; attempt++ {
@@ -58,7 +65,19 @@ func (r *retryDoer) Do(req *http.Request) (*http.Response, error) {
 			req.ContentLength = int64(len(body))
 		}
 		resp, lastErr = r.next.Do(req)
-		if !shouldRetry(resp, lastErr, retryable, attempt, r.cfg.MaxAttempts) {
+		retry := shouldRetry(resp, lastErr, retryable, attempt, r.cfg.MaxAttempts)
+		if lastErr != nil || (resp != nil && resp.StatusCode >= 400) {
+			status := 0
+			if resp != nil {
+				status = resp.StatusCode
+			}
+			action := "Request failed."
+			if retry {
+				action += " Retrying request."
+			}
+			debuglog.Printf(req.Context(), "@automattic/vip:http:graphql", "%s Operation: %s. Attempt: %d. Status code: %d.", action, operationName, attempt, status)
+		}
+		if !retry {
 			return resp, lastErr
 		}
 		if resp != nil {

package/internal/gql/transport.go

@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 type transport struct {
@@ -31,6 +33,13 @@ func (t *transport) Do(req *http.Request) (*http.Response, error) {
 	if req.Header.Get("Content-Type") == "" {
 		req.Header.Set("Content-Type", "application/json")
 	}
+	// Mirror Node's HTTP diagnostic without exposing URL credentials or
+	// arbitrary query parameters (which can contain signed download tokens).
+	safeURL := *req.URL
+	safeURL.User = nil
+	safeURL.RawQuery = ""
+	safeURL.Fragment = ""
+	debuglog.Printf(req.Context(), "@automattic/vip:http", "running fetch %s", safeURL.String())
 	return t.cfg.HTTPClient.Do(req)
 }
 

package/internal/httpproxy/debug_test.go

@@ -0,0 +1,32 @@
+package httpproxy
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestProxyDiagnosticOmitsCredentials(t *testing.T) {
+	clearProxyEnv(t)
+	t.Setenv("VIP_PROXY", "socks5://user:proxy-secret@localhost:1080")
+	var out bytes.Buffer
+	ctx := debuglog.WithLogger(context.Background(), "vip:proxy-dispatcher", &out)
+	req, _ := http.NewRequestWithContext(ctx, "GET", "https://example.test/graphql?token=request-secret", nil)
+	u, err := ProxyURL(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if u == nil || u.User == nil {
+		t.Fatal("proxy authentication lost")
+	}
+	if !strings.Contains(out.String(), "socks5://localhost:1080") {
+		t.Fatalf("missing proxy diagnostic: %q", out.String())
+	}
+	if strings.Contains(out.String(), "secret") || strings.Contains(out.String(), "user") {
+		t.Fatalf("credentials exposed: %q", out.String())
+	}
+}

package/internal/httpproxy/httpproxy.go

@@ -21,6 +21,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/Automattic/vip/internal/debuglog"
 )
 
 // ProxyURL is the port of createProxyAgent (proxy-agent.ts:20-46). It is shaped
@@ -41,10 +43,15 @@ import (
 // Errors are returned rather than swallowed. A proxy the user configured but
 // that we cannot honour must fail the request; silently connecting direct is
 // how the SOCKS half of this bug went unnoticed.
-func ProxyURL(req *http.Request) (*url.URL, error) {
+func ProxyURL(req *http.Request) (selected *url.URL, err error) {
 	if req == nil || req.URL == nil {
 		return nil, nil
 	}
+	defer func() {
+		if selected != nil && err == nil {
+			debuglog.Printf(req.Context(), "vip:proxy-dispatcher", "Enabling fetch dispatcher proxy support using config: %s://%s", selected.Scheme, selected.Host)
+		}
+	}()
 	target := req.URL
 
 	// 1. VIP Socks Proxy takes precedence and is fully backward compatible.

package/internal/installer/version.go

@@ -0,0 +1,41 @@
+// Package installer defines the version contract shared by native packages.
+package installer
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+var versionPattern = regexp.MustCompile(`^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-(?:(alpha|beta|rc)\.(0|[1-9][0-9]*)|dev\.[0-9A-Za-z]+))?$`)
+
+// NumericVersion preserves release ordering in MSI's three numeric fields.
+// Each patch reserves 1000 values: dev=0, alpha=100..299, beta=300..499,
+// rc=500..699, stable=999. Bounds are checked rather than silently truncating
+// a version, which could otherwise make a newer release look like a downgrade.
+func NumericVersion(version string) (string, error) {
+	m := versionPattern.FindStringSubmatch(version)
+	if m == nil {
+		return "", fmt.Errorf("invalid installer version %q", version)
+	}
+	values := make([]int, 3)
+	for i, max := range []int{255, 255, 64} {
+		n, err := strconv.Atoi(m[i+1])
+		if err != nil || n > max {
+			return "", fmt.Errorf("installer version %q exceeds numeric field %d limit %d", version, i+1, max)
+		}
+		values[i] = n
+	}
+	stage := 999
+	if m[4] != "" {
+		n, err := strconv.Atoi(m[5])
+		if err != nil || n > 199 {
+			return "", fmt.Errorf("installer prerelease number must be between 0 and 199")
+		}
+		stage = map[string]int{"alpha": 100, "beta": 300, "rc": 500}[m[4]] + n
+	} else if strings.Contains(version, "-dev.") {
+		stage = 0
+	}
+	return fmt.Sprintf("%d.%d.%d", values[0], values[1], values[2]*1000+stage), nil
+}

package/internal/installer/version_test.go

@@ -0,0 +1,33 @@
+package installer
+
+import "testing"
+
+func TestNumericVersion(t *testing.T) {
+	for _, tt := range []struct{ input, want string }{
+		{"5.0.0-dev.abc1234", "5.0.0"},
+		{"5.0.0-alpha.0", "5.0.100"},
+		{"5.0.0-alpha.199", "5.0.299"},
+		{"5.0.0-beta.0", "5.0.300"},
+		{"5.0.0-beta.199", "5.0.499"},
+		{"5.0.0-rc.0", "5.0.500"},
+		{"5.0.0-rc.199", "5.0.699"},
+		{"5.0.0", "5.0.999"},
+		{"5.0.1-alpha.0", "5.0.1100"},
+		{"5.12.3-alpha.10", "5.12.3110"},
+		{"255.255.64", "255.255.64999"},
+	} {
+		t.Run(tt.input, func(t *testing.T) {
+			got, err := NumericVersion(tt.input)
+			if err != nil || got != tt.want {
+				t.Fatalf("got %q, %v; want %q", got, err, tt.want)
+			}
+		})
+	}
+	for _, input := range []string{"", "v5.0.0", "5.0", "5.0.0-beta1", "5.0.0-beta.200", "5.0.0-alpha.01", "5.0.0-rc.-1", "256.0.0", "5.256.0", "5.0.65", "05.0.0", "5.0.0-unknown.1", "5.0.0-dev.", "5.0.0+meta", "9999999999999999999999.0.0"} {
+		t.Run(input, func(t *testing.T) {
+			if got, err := NumericVersion(input); err == nil {
+				t.Fatalf("accepted %q as %q", input, got)
+			}
+		})
+	}
+}

package/internal/parity/edge_workers_debug_test.go

@@ -0,0 +1,87 @@
+//go:build parity
+
+package parity
+
+import (
+	json "encoding/json/v2"
+	"reflect"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// This catches debug flags being parsed but never connected to the transport,
+// namespace filters being ignored, and diagnostics contaminating JSON stdout.
+func TestEdgeWorkersListDebugParity(t *testing.T) {
+	rig, skip := differentialAvailable(t)
+	if skip != "" {
+		t.Skip(LoudSkip("Edge Workers debug real Node-vs-Go comparisons", skip))
+	}
+	for _, tc := range []struct {
+		name     string
+		flags    []string
+		env      string
+		wantHTTP bool
+	}{
+		{name: "disabled"},
+		{name: "short", flags: []string{"-d"}, wantHTTP: true},
+		{name: "long", flags: []string{"--debug"}, wantHTTP: true},
+		{name: "matching", flags: []string{"--debug=@automattic/vip:http"}, wantHTTP: true},
+		{name: "matching-separated", flags: []string{"--debug", "@automattic/vip:http"}, wantHTTP: true},
+		{name: "nonmatching-separated", flags: []string{"-d", "unrelated:namespace"}},
+		{name: "wildcard-exclusion", flags: []string{"--debug=*,-@automattic/vip:http"}},
+		{name: "nonmatching", flags: []string{"--debug=unrelated:namespace"}},
+		{name: "environment", env: "@automattic/vip:http", wantHTTP: true},
+		{name: "flag-overrides-environment", env: "@automattic/vip:http", flags: []string{"--debug=unrelated:namespace"}},
+		{name: "empty-flag-keeps-environment", env: "@automattic/vip:http", flags: []string{"--debug="}, wantHTTP: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var outputs [2]any
+			for side, bin := range []string{rig.nodeBin, rig.goBin} {
+				api := newEdgeFixtureAPI("inactive")
+				// A list response has no reason to reveal stored source in diagnostics.
+				api.workers[0]["source"] = "debug-parity-private-source"
+				rig.serve(t, api)
+				env := rig.scenarioEnv(&Scenario{Env: map[string]string{"DEBUG": tc.env}})
+				args := append([]string{"edge-workers", "list", "--app=42", "--env=develop", "--format=json"}, tc.flags...)
+				result, err := Run(RunSpec{Binary: bin, Dir: t.TempDir(), Argv: args, Env: FixtureEnv(env)})
+				if err != nil {
+					t.Fatal(err)
+				}
+				if result.ExitCode != 0 {
+					t.Fatalf("side %d exited %d: %s", side, result.ExitCode, result.Stderr)
+				}
+				// Approved runtime banner difference, CUTOVER-BREAKING-CHANGES 1.10.
+				stdout := regexp.MustCompile(`(?m)^Debug:  VIP-CLI v[^,\n]+, Node v[^,\n]+, [^,\n]+, Runtime node-script\n`).ReplaceAllString(result.Stdout, "")
+				if err := json.Unmarshal([]byte(stdout), &outputs[side]); err != nil {
+					t.Fatalf("side %d stdout is not JSON: %v\n%s", side, err, stdout)
+				}
+				count := 0
+				for _, line := range strings.Split(result.Stderr, "\n") {
+					if strings.Contains(line, "@automattic/vip:http running fetch "+rig.srv.URL+"/graphql") {
+						count++
+					}
+				}
+				wantCount := 0
+				if tc.wantHTTP {
+					wantCount = 2 // app resolution, then EdgeWorkers
+				}
+				if count != wantCount {
+					t.Errorf("side %d HTTP diagnostics = %d, want %d; stderr:\n%s", side, count, wantCount, result.Stderr)
+				}
+				for _, secret := range []string{rig.token, "debug-parity-private-source", "Bearer ", `"variables":`, `"edgeWorkers":`} {
+					if strings.Contains(result.Stderr, secret) {
+						t.Errorf("side %d diagnostics exposed credential or payload data", side)
+					}
+				}
+				ops, observations := api.snapshot()
+				if len(ops) != 0 || len(observations) != 1 || observations[0].Operation != "EdgeWorkers" || observations[0].Source {
+					t.Errorf("side %d did not perform exactly one source-free list: operations=%v requests=%v", side, ops, observations)
+				}
+			}
+			if !reflect.DeepEqual(outputs[0], outputs[1]) {
+				t.Errorf("JSON output differs: Node=%v Go=%v", outputs[0], outputs[1])
+			}
+		})
+	}
+}